As used herein, peer to peer networks which are the subject of the present invention comprise multiple nodes, each node typically consisting both of file server and client which can send and receive data or “Communication messages” to or from a node to which such is connected.
In a peer to peer network each node is connected to other nodes over a communication medium such as the internet either directly or through some type of proxy. For example, when a search request is issued such originating node sends a search request to all of the nodes to which it is connected. (see FIG. 1) These nodes search their list of available files and if a match is found they send a response back with the location. However, a peer to peer proxy network typically consists of node A which is connected to a node B and node B is connected to a node C. (see FIG. 2) Node A is not connected to node C such that if node A issues a search request it will be forwarded to node B and Node B will search its available files and if a match is found it will send a response back to node A. Node B will then forward node A's request to node C and Node C will search its available files and if a match is found it will send a response back to node B. Node B will then forward this response to node A. FIG. 3 discloses a nonproxy loop network wherein each node is directly connected to another.
Some peer to peer networks utilize a leaf node/main node proxy topology (See FIG. 4) where some nodes are classified as main nodes and the remaining nodes are classified as leaf nodes. Leaf nodes can only connect to main nodes. Only main nodes can connect to other main nodes. When a leaf node issues a search request it sends the request to the main node that it is connected to. The main node then forwards the request to any other leaf nodes that are connected to it and also to any main nodes it is connected to. These main nodes forward the request to any leaf nodes that are connected to them.
Commonly these networks are used to share music, movies, and software files among its users. To access this network a user installs a Peer-to-Peer client software application that is capable of connecting to, and utilizing the Peer-to-Peer network. When installing the software the user must select a folder on their computer system in which to store any downloaded files. Any files placed into this folder are also made available to other users. For instance, if user #1 places a file named “foofile” in their shared folder, user #2 would then be able to access and download the file.
For whatever reason, users sometimes select a folder that contains sensitive information or information they do not otherwise wish to share as the shared folder or they may later begin to place sensitive information or information they do not otherwise wish to share into their shared folder by mistake. Usually this action is done by mistake and unknowingly by the user but sometimes it is done by a malicious person. Sometimes the Peer-to-Peer client software has a software bug that permits the sharing of files and directories that the user never intended to be shared. Sometimes it is a violation of corporate policy to have Peer-to-Peer client software installed.
The information shared may be detrimental the user, the company they work for, or even to national security. It would therefore be advantageous to network administrators or others whose responsibility it is to enforce information containment to be able to locate computers with Peer-to-Peer network software installed so that it can be assessed or removed. It would also be advantageous to know if Peer-to-Peer network software has ever been installed and utilized so that a threat assessment can be made.
Accordingly it is an object of the present invention to provide a system for scanning a computer to ascertain whether or not it is, has, or can participate in a Peer-to-Peer network.